Re: [Sat] I-D Action: draft-ietf-satp-core-04.txt

[Martin Gfeller <[e-mail]>]

Dear Martin, Thomas, and Rafael

The following notes refer to the Draft of SATP Core (
https://datatracker.ietf.org/doc/html/draft-ietf-satp-core-04).

Again, my comments may show my limited understanding or my stumbling over
certain wordings.

Kind regards, Martin

General

    Is there any reference to the architecture document, which is important
to the
    understanding of this document?

3. Terminology

    Client application: This is the application employed by a user to
interact with a gateway.


        Do we need to say what we want to achieve with the application?
Simply interacting
       could mean anything.
        As the introduction mentions only gateways, this is the first time
"application" is used.

    Claim: An assertion made by an Entity [JWT].

        By referencing [JWT], do we prescribe that Claims are encoded as
JWTs?
        Either state more explicitly "encoded as JWT", or relax it, as "for
example encoded
        as JWT".

    Claim Type:

        Stipulates that JWT above is just one option. Perhaps always have
"X type" before "X";
         i.e., "claim type" before "claim"

    Network:
        Might be worthwhile to define network.


4.2 SAT Model

    When do we speak about SAT and when about SATP?

        I think the model is for the protocol, so SATP Model, not SAT Model.

    local gateway

        "local" is understandable, but not actually defined. As the
application is defined
         to interact with a gateway, a gateway is always "local" from the
perspective of
        the application.

4.7.2 Message Type

    Inconsistent style - drop the  "This is the "

4.7.3 Digital Asset Identifier

    unique identifier (UUIDv2) that uniquely identifies

        unique, more unique, most unique? :-)

    application of the beneficiary

        This is the first time the application in NW2 is mentioned in an
active role - in
        the document above this point, I understood that while the NW2 and
GW2 are involved,
        the application of the beneficiary is not actively involved.

4.7.4 Session ID: (delete the ":")

        Was the Context-Id introduced? Yes, but below. Somewhat circular.
Same problem
        noted in Architecture document.

4.7.5 Transfer-Context ID

        Is the "Sequence Number" part of the Transfer-Context ID, or a
possible implementation,
        or something additional?

4.7.8.  Payload Hash

        Is the algo to be used intentionally left open?


4.8  Negotiation of Security Protocols and Parameters

    transfer initiation stage (Stage-0)

        Isn't that Stage-1, according to 4.4?

7-9: Stages

    Do we need to repeat the use of HTTP GET and POST - until the
parenthetical remark
    about the TLS nonce for each Stage?

10.2

        The purpose The purpose

    Repeated.

17.2 Informative References

    Wouldn't including references to the SATP Architecture and Use Cases
documents be good?




On Fri, Apr 5, 2024 at 10:24 AM <[e-mail]> wrote:

> Internet-Draft draft-ietf-satp-core-04.txt is now available. It is a work
> item
> of the Secure Asset Transfer Protocol (SATP) WG of the IETF.
>
>    Title:   Secure Asset Transfer Protocol (SATP) Core
>    Authors: Martin Hargreaves
>             Thomas Hardjono
>             Rafael Belchior
>    Name:    draft-ietf-satp-core-04.txt
>    Pages:   39
>    Dates:   2024-04-05
>
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-satp-core/
>